# albok browse view: sshfs pathname-withdrawal test (unit 4.3 exposure gate)

The albok unit 4.3 contract gates any workstation exposure of a wing's `.browse/` on infra-ops
demonstrating, on the chosen share surface, that renaming `.browse/` away on the server denies a
**fresh open of a never-opened child through a listing the client has cached**. The rename is what
albok-service does when it withholds a view (`.browse/` → `.browse.withheld/`).

**Result (2026-10-09 2019–2021 PT): PASS on sshfs `follow_symlinks`, Linux client.** Raw output:
`results-20261009-2019.json`; replica ids: `manifest.json`.

## Harness

- **Server:** a replica of a browse view on nh3-albok (`setup-replica.py`): 60 × 1 MiB objects at
  `<wing>/<id[:2]>/<id>/<blob>`, `.browse/stash/<name>` → `../../<id[:2]>/<id>/<blob>`, the same shape
  as the live view. Same root ext4 and the same OpenSSH `sftp-server` as `/srv/albok`. The live view
  was NOT used: renaming it races albok-service's link/unlink and a failed mandatory unlink withholds
  the wing. The replica was removed after the run (ops-log 2026-10-10T03:22:22Z).
- **Client:** ephemeral `debian:bookworm-slim` container on nh3-dev (`run.sh`): SSHFS 3.7.3,
  libfuse 3.14.0, FUSE kernel interface 7.31, host kernel 6.1. Mount: `ro,follow_symlinks` plus SSH
  options; the mount root is `.browse/` alone.
- **Per trial**, on a fresh mount: list `stash/` and stat every child (the client's caches now hold
  the listing and every child's attributes); open+close child A; open child B and **hold** the fd;
  rename on the server with `os.rename`; then immediately list again, stat C, open C (never opened
  before), read B at offset 1 MiB − 8 KiB (past readahead, so it must reach the server), re-open A.
- **Conditions, N = 5 each**, distinct children every trial:
  `null` (no rename), `default` (sshfs defaults), `aggressive` (`kernel_cache,entry_timeout=3600,
  attr_timeout=3600,dir_cache=yes,dcache_timeout=3600`), `failed_rename` (target pre-created
  non-empty, so `rename(2)` refuses with ENOTEMPTY).

## Results

| condition | rename | cached list after | stat C after | **open C (fresh)** | held B far read | re-open A | list at +25 s |
|---|---|---|---|---|---|---|---|
| null (null control) | none | 60 | ok | **opens, bytes ok** 5/5 | ok 5/5 | opens 5/5 | n/a |
| default | ok | 60 (stale) | ok (cached) | **ENOENT 5/5** | ok 5/5 | ENOENT 5/5 | ENOENT 5/5 |
| aggressive caches | ok | 60 (stale) | ok (cached) | **ENOENT 5/5** | ok 5/5 | ENOENT 5/5 | n/a |
| failed_rename | refused ENOTEMPTY | 60 | ok | **opens, bytes ok** 5/5 | ok 5/5 | opens 5/5 | n/a |

The fresh open was attempted 2–6 ms after the rename returned. Every trial started and ended with
the server in the clean state (`.browse/` present, no `.browse.withheld`).

- **The gate holds.** The client still listed the child and stat'ed it from cache, and the open
  failed anyway: each sshfs open is an SFTP OPEN by path, resolved on the server, and hour-long
  client caches do not change that.
- **Controls.** With no rename every open succeeds (the method does not manufacture failures). The
  held fd keeps reading after the rename, and a refused rename leaves every path served, so the
  instrument does register access that survives a rename (positive controls).
- **What a rename does NOT withdraw:** a file already open on the client keeps reading through its
  SFTP handle. That is the contract's narrowed guarantee (new access by pathname only).
- **Failed rename:** the path remains and is served. The service cannot deny opens it could not
  withdraw; its `BROWSE_WITHHELD` marker only stops publication.

## Limits

- **Proven for the Linux kernel FUSE client only.** A macOS workstation runs a different FUSE
  backend (macFUSE kext, macFUSE FSKit, or fuse-t, which is NFS-backed and may cache handles the way
  the contract warns NFS does). Re-run this harness on the real workstation before trusting that
  surface: rebuild the replica, then run `run-trials.py` directly with `ALBOK_TEST_KEY`,
  `ALBOK_TEST_KNOWN_HOSTS`, `ALBOK_TEST_MNT` (and `ALBOK_TEST_SRV`) set.
- **The mount root is a presentation choice, not a boundary.** The SSH user's authority is whatever
  its groups can read: a member of the wing's read group can mount the wing root and see raw object
  directories, sidecars with their sensitivity records, and git history. The contract already says
  this ("the wing group's raw read is authority over files").
- The committed `run-trials.py` adds env overrides and a umount fallback after the run; the container
  defaults it ran with are unchanged.